NarcoFiles: The New Criminal Order is an international investigation into modern-day organized crime and those who fight it. A collaboration between more than 40 media outlets, it is the largest investigative project on organized crime to originate in Latin America, a region hit hard by drug trafficking and the violence and corruption that come with it.
The project was sparked by a leak of emails from the Colombian prosecutor’s office, known as Fiscalía General de la Nación. The leak was shared last year with OCCRP and several Latin American outlets, including Cerosetenta / 070, Vorágine, and the Centro Latinoamericano de Investigación Periodística (CLIP).
OCCRP collated the data and brought in media organizations from 23 countries across the Americas and Europe to analyze the contents. The resulting stories provide a rare window into how criminal groups are collaborating, communicating, and innovating in a globalized world.
In 2022, a group of “hacktivists” known as Guacamaya obtained the emails by breaking into the Microsoft Exchange Server, a platform used by the Colombian prosecutor’s office. In a press release attributed to the collective, Guacamaya said they had targeted institutions they accused of enabling corruption and organized crime.
Microsoft had asked its clients to make a security update earlier in the year, but many companies and institutions in Latin America failed to do so. Guacamaya was able to exploit this vulnerability to hack the prosecutor’s office as well as several other military and police institutions, regulatory agencies, and companies across Latin America.
They shared the data with two organizations: Distributed Denial of Secrets, a collective that distributes and archives leaked data of public interest; and Enlace Hacktivista, a web page that publishes information about hacking tools and news. These two groups shared the leak with OCCRP and several Latin American media outlets.
The Colombian prosecutor’s office launched a criminal investigation into the breach in October 2022. The office also said it was looking into the contractor in charge of its IT infrastructure. In January this year, Deputy Prosecutor Martha Mancera said the office was taking measures to tighten cybersecurity.
OCCRP and its partners in Colombia contacted the prosecutor’s office to request an interview and sent a set of questions about the leak. By the time of publication, the office had not responded.
At five terabytes, the leak contains more than seven million emails from the Colombian prosecutor’s office, including correspondence with embassies and other authorities around the world. The files — which also comprise audio clips, PDFs, spreadsheets, and calendars — date to 2001, though most of the information is concentrated between 2017 and 2022.
Documents in the leak reveal rare details about the inner workings of transnational criminal gangs and law enforcement’s efforts to dismantle them. In their stories, reporters explored six main themes:
To confirm the leak’s authenticity, reporters cross-checked identifying data, such as court case numbers, with publicly available information. National identification numbers were checked against public databases, and company names and ownership information were verified in corporate registries. The names of prosecutors and agents were also checked on agency webpages.
To further corroborate the data, reporters filed public information requests, reviewed hundreds of public and private documents and databases, and interviewed police, convicted criminals, experts, and victims of the drug trade.
After sorting through the emails, reporters identified leads that were used as starting points for further investigation. In most cases, documents from the leak ended up comprising only a small portion of the sources used in each story. Measures were also taken to protect third parties and to avoid disrupting ongoing investigations.
Organized crime fuels corruption, devastates the environment, sows inequalities, and slows economic development. That is why it is essential for investigative journalism to expose the people behind drug trafficking and other criminal activities and show how they operate.
In Colombia, citizens have the right to access information of public interest, and media outlets have the right to publish this information, regardless of the source. One of the country’s highest tribunals, the Constitutional Court, has ruled that no sources are inherently off limits for journalists.
Jonathan Bock, director of the Foundation for Press Freedom, a Colombian advocacy organization known by its Spanish acronym FLIP, told OCCRP that “the right to freedom of expression means that the media have the right to disseminate information according to their own editorial criteria, as long as they act in compliance with the law and under [the principles of] journalistic responsibility.”
Journalists from more than 40 media outlets published investigations in the NarcoFiles project. The organizations include:
Fact-checking was provided by the OCCRP Fact-Checking Desk.
